don't list expired

I'm not sure if this is the best solution, or if we should even consider it a problem.

Server re-serializes expired certs after they expire, but before they are cleaned up.  This keeps an expired cert on the clients disk.  Subscription-manager ignores the certificate, so it's not a problem, and the client will get rid of the certificate on its next check-in after the server deletes it.

This patch just filters the list of reported entitlements, perhaps we should force the removal at this point, if that is possible.